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Abstract 

Parametric down-conversion (PDC) sources can be used for quantum key distribution (QKD). 
One can use a PDC source as a triggered single photon source. Recently, there are various practical 
proposals of the decoy state QKD with triggering PDC sources. In this paper, we generalize 
the passive decoy state idea, originally proposed by Mauerer and Silberhorn. The generalized 
passive decoy state idea can be applied to cases where either threshold detectors or photon number 
resolving detectors are used. The decoy state protocol proposed by Adachi, Yamamoto, Koashi and 
Imoto (AYKI) can be treated as a special case of the generalized passive decoy state method. By 
simulating a recent PDC experiment, we compare various practical decoy state protocols with the 
infinite decoy protocol and also compare the cases using threshold detectors and photon-number 
resolving detectors. Our simulation result shows that with the AYKI protocol, one can achieve a 
key generation rate that is close to the theoretical limit of infinite decoy protocol. Furthermore, 
our simulation result shows that a photon-number resolving detector appears to be not very useful 
for improving QKD performance in this case. Although our analysis is focused on the QKD with 
PDC sources, we emphasize that it can also be applied to other QKD setups with triggered single 
photon sources. 
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I. INTRODUCTION 



Quantum key distribution (QKD) [l, 2] allows two legitimate parties, Alice and Bob, to 
create a random secret key even when the channel is accessible to an eavesdropper, Eve. The 
security of QKD is built on the fundamental laws of physics in contrast to existing classical 
public key encryption schemes that are based on unproven computational assumptions. 
Bennett and Brassard proposed a best-known protocol — BB84 [1]. Proving the security 
of QKD is a hard problem. Fortunately, this problem has been solved in the last decade, 
see for example, {3], 0, 5,0]. Many security proofs are based on the assumption of idealized 
QKD system components, such as a perfect single photon source and well-characterized 
detectors. In practice, inevitable device imperfections may compromise the security unless 
these imperfections are well investigated. Meanwhile, the security of QKD with realistic 
devices has been proven. See (3, [si, 



10, 



11 



121 ] for example. 



In the original proposal of BB84 protocol, a single photon source is used. Unfortunately, 
single photon sources are still not commercially available with current technology. Alterna- 
tively, a weak coherent state is widely used as a photon source. We call this implementation 
coherent state QKD. Many coherent state QKD experiments have been done since the first 
QKD experiment 131 ]. 



The coherent state QKD suffers from photon-number splitting (PNS) attacks |9l. Il4j. |15|. 
Nevertheless, it has been proven unconditionally secure by Inamori, Liitkenhaus and Mayers 
1(3 ]. This work is improved by Gottesman, Lo, Liitkenhaus, and Preskill (GLLP) |12]. 
though the performance in terms of the achievable secure distance and the key rate is 
limited. 

n 

Decoy state method [16| has been proposed to improve the performance of the coherent 
state QKD. The security of QKD with decoy states has been proven [n], 18, [lj]]. The 
simulation result shows us that the coherent state QKD with decoy states is able to operate 
as good as QKD with perfect single photon sources in the sense that the key generation 
rates given by both setups depend linearly on the channel transmittance 19]. Afterwards, 
some practical decoy-state protocols with only one or two decoy states are proposed [201 ] . 



see also 



21 



22, 



done recently 



23]. The experimental demonstrations for decoy state method have been 



24 



25 
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27, 28, 



29J. 



The motivation of decoy states is to estimate the channel properties (e.g., transmittance 
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and error proability) better. To do that, Alice uses extra states with different light intensities 
during key transmission. Then Alice and Bob can consider detection statistics from signal 
and decoy states separately, from which they can estimate the channel transmittance and 
error probability better. We call the situation when Alice actively prepare decoy states 
active decoy state method to differentiate from the passive decoy state method where Alice 
choose decoy and signal states by passive measurements. Details can be found in Section 
HVl We note that in coherent state QKD, one can only use active decoy state method. 

Other than the decoy state method, we remark that there are other approaches to enhance 
;he performance of the coherent state QKD, such as QKD with strong reference pulses 



3C|, |3J| and differential-phase-shift QKD [32|. 



Besides a coherent state source, a parametric down-conversion (PDC) source can be used 
for QKD as well. There are two ways to use a PDC source for QKD. The first is to use it as 
a triggered (heralded) single photon source. Alice detects one of the two modes from a PDC 
source as a trigger 43] and actively encodes her qubit information into another mode. We 
call this implementation triggering PDC QKD. The second way is to use it as an entangled 
photon source for entanglement-based QKD protocols. See Ref. [33J and references cited 
therein. We call this implementation entanglement PDC QKD. 

The triggering PDC QKD, similar to the coherent state QKD, suffers from PNS attacks. 
By applying the GLLP security proof, one can find that the optimal average photon number 
fj, is in the same order of overall transmittance rj. Then the key generation rate will be on the 
order of rf. For a rigorous derivation, one can refer to Appendix |A] Thus, the performance 
of the triggering PDC QKD is very limited. 

Since decoy states idea can substantially enhance the performance of the coherent state 
QKD, a natural question will be: "can decoy states idea be applied to the triggering PDC 
QKD?" The answer is yes. One can apply the infinite decoy state idea [3] to the triggering 
PDC QKD. Not surprisingly, with decoy states, the key generation rate can be 0(rj), which 
is the same as the order achieved by a single-photon source. Therefore, we expect the decoy 
state QKD to become a standard technique not only in the coherent state QKD, but also 
in QKD with triggering PDC sources. The infinite decoy state protocol requires an infinite 
number of decoy states to be used, which is not practical. A few practical decoy proposals for 
triggering PDC requiring a finite number of decoy states have been proposed 



35|,l3J,l37|. 



34 



We are interested in comparing various protocols for the triggering PDC QKD. Among 
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the practical decoy protocols for triggering PDC QKD, we find that the one proposed by 
Adachi, Yamamoto, Koashi and Imoto (AYKI) |35] is simple to implement. The AYKI 
protocol is conceptually similar to the one-decoy-state scheme 20]. In the AYKI protocol, 
Alice and Bob only need to consider the statistics of triggered and non-triggered detection 
events [48j separately, instead of preparing new signals for decoy states. We emphasize that 



the AYKI protocol is easy to implement since there is no need for a hardware change. 

Other decoy state proposals for the triggering PDC QKD require hardware modifications. 
For example, the one proposed by Mauerer and Silberhorn 34j requires photon-number 
resolving detectors, and the one proposed by Wang, Wang and Guo [36( requires Alice's 
pumping the laser source at various intensities. 



34j]. The 



We generalize the passive decoy state idea proposed by Mauerer and Silberhorn 
main idea is that, Bob can group his detection events according to the public announcement 
of Alice's detection events. For example, when Alice uses a threshold detector, Bob can group 
his detection results according to whether Alice gets a detection or not. The generalized 
passive decoy state idea can be applied to both cases of using threshold detectors and 
photon-number resolving detectors. The AYKI protocol can be treated as a special case of 
the generalized passive decoy state protocol. 



By simulating a recent PDC experiment 



we compare one case with a perfect photon- 



number resolving detector and four cases with threshold detectors: no decoy, infinite decoy, 
weak decoy and AYKI. Our simulation result shows that in a large parameter regime, the 
performance of AYKI protocol is close to that of the infinite decoy protocol and thus there 
is not much room left for improvement after the AYKI protocol has been implemented. 
Also, the QKD performance of the case with the infinite decoy protocol using threshold 
detectors is close to the case using a perfect photon-number resolving detector. Thus, a 
photon-number resolving detector appears to be not very useful for triggering PDC QKD. 

We emphasize that one advantage of passive decoy state method is that by passively 
choosing decoy and signal states, the possibility that Eve can distinguish decoy and signal 
states is reduced. On the other hand, in active (regular) decoy state experiments, it is more 
difficult to verify the assumption that Eve cannot distinguish decoy and signal states. 

We note that the passive decoy state idea can be combined to the active decoy state idea. 
In Ref. {37], the authors gave a special case of combining passive and active decoy state 
ideas. Note that for coherent state QKD, one can only use active decoy state methods. 
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Although our analysis is focussed on the QKD with PDC source, we emphasize that it 
can also be applied to QKD setups with other triggered single photon sources. 

In Section [IIJ we will review the experiment setup of the triggering PDC QKD. In Sec- 
tion we give a model for the triggering PDC QKD. In Section IIV[ we will study vari- 
ous post-processing schemes for the triggering PDC QKD. In Section |Vj we will compare 
various schemes of the triggering PDC QKD: non-decoy+threshold detectors, infinite de- 
coy+threshold detectors, AYKI and the case with a perfect photon-number resolving detec- 
tor, by simulating a real PDC experiment. In Appendix [Aj we consider the optimal PDC 
source intensities for the triggering PDC QKD. 



II. EXPERIMENT SETUP 



In triggering PDC QKD, a PDC source is used as a triggered single photon source [49] 
The schematic diagram is shown in FIG. [U 



n 




Channel 




FIG. 1: A schematic diagram for the triggering PDC QKD. Alice collects photon pairs emitted 
from a PDC source and uses a polarized beam splitter (PBS) to separate two polarization modes. 
She detects one of the two modes with her detector (DA) as a trigger, modulates the polarization 
of the other mode by a polarization controller (PC) and sends it to Bob. On Bob's side, he chooses 
his basis by a PC and performs a measurement by his detectors (DBq and DBi). 



As shown in FIG. [TJ a PDC source generates two modes of photons, which can be sep- 
arated by a polarized beam splitter (PBS). One mode goes to Alice's own detector (DA in 
FIG. [1]) as the triggering signal and the other mode is used as a triggered single photon 
state for the QKD. When Alice's detector (DA) clicks, we call it a trigger. We divide the 
detection events on Bob's side into two groups depending on whether Alice gets a trigger or 
not: triggering detection events and non-triggering detection events. 
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Note that Alice can use either a threshold detector or a photon-number resolving detector 
(DA in FIG. [[]). She only needs to know the number of photons in the trigger mode. So 
only one detector is sufficient on Alice's side. Due to the high channel losses, without 
Eve's interference, Bob is highly likely to receive a vacuum or single photon state. Thus 
it is sufficient for Bob to use threshold detectors. Threshold single photon detectors can 
only tell whether there a click or not, but not the photon numbers. Bob needs to identify 
polarizations of incoming photons. Here we assume Alice encodes qubit information in 
photon polarizations. 

In real experiments, there are two types of PDC sources. In triggering PDC QKD, both 
of these two types can be used. Here we assume Alice uses type-II PDC source. The 
Hamiltonian of the type-II PDC process in the triggering setup shown in FIG. [TJ can be 
written as [39j 

H = ixa ] b ] + h.c. (1) 

where h.c. means Hermitian conjugate and x is a coupling constant which depends on the 
crystal nonlinearity and the amplitude of the pump beam. The operators a\ and a, b are 
the creation and annihilation operators of two modes with different polarizations. 

The state coming from a triggering PDC source, with a Hamiltonian of Eq. ([TJ), can be 



written as 



39| 

oo 

|^) = (coshxT 1 y^(tanhx)"K n). (2) 

n=0 

Here we assume the state is single-mode. The expected photon pair number is given by 
jj, = sinh 2 x- The probability to get an n-photon-pair is 

n 

P(n) = - . (3) 

Here we assume that the PDC source always sends out photon pairs. That is, the photon 
number of mode a and b are always the same. 

There is a nonzero probability for the PDC source to emit more than one photon pairs 
in one pulse. Thus, Alice may send out multi photon states after she encodes basis and key 
information by her polarization controller (PC). This is the reason why the triggering PDC 
QKD suffers from PNS attacks. 

Let us compare triggering PDC QKD and entanglement PDC QKD implementations. 



For the setup of entanglement PDC QKD, one can refer to Ref. 33j. In the triggering PDC 
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QKD Alice actively encodes the key information, while in the entanglement PDC QKD 
Alice measures the polarization of one mode of PDC source directly. The advantage of the 
triggering PDC QKD here is that it does not rely on the polarization correlations between 
two modes of the PDC source. It only requires photon-pair generation of the source, which 
means entanglement between photon pairs are not important for triggering PDC QKD. 
However, in entanglement PDC QKD implementation, the entanglement between two modes 
has to be well maintained for QKD transmission. We notice that maintaining entanglement 
in real experiments is a highly non-trivial task [so| . 



III. MODEL 



Liitkenhaus has already studied the model of triggering PDC QKD [8| with threshold 
detectors. His model is similar to the one of the coherent state QKD, except for a different 
photon number distribution. For the model of the coherent state QKD, one can refer to 
Ref. 0, 20]. For the model of entanglement PDC QKD, one can refer to Ref. 33]. 



A. Photon number channel model 



Here we will use the photon number channel model |19j: Alice and Bob have infinite 
number of channels. For channel i, Alice uses z-photon states (Fock states) to carry the 
qubit information, with % = 0, 1, 2 • • • . The zth channel corresponds to the case when Alice's 
photon source emits an z-photon state. Thus, the probability for Alice to use the ith channel 
is determined by the photon source. For example, in coherent state QKD, the probability 
for Alice using the different channels follows a Poisson distribution. For the details of the 
photon number channel model, one can refer to Ref. j^ . 

We define the yield to be the probability for Bob to get a detection event conditioned 
on Alice using the zth channel. As discussed in Section [Til we assume that Bob uses a 
threshold detector. The yield is given by 

Y i = l-(l-Y 0B )(l-r } ) i , (4) 

where Yob is the background count rate of Bob's detection system, and r\ is the overall 
detection probability for Bob, which takes into account the channel transmission efficiency, 
the coupling efficiency, the detector efficiency and the other losses in Bob's box. 



The error rate when Alice uses ith channel is given by 

tiYi = e d Yi + (e - e d )Y 0B (5) 

where eo = 1/2 is the error rate of background counts, e& is the intrinsic detector error rate 
on Bob's side (e.g., due to misalignment) and Y$ is given by Eq. (j3J). Here, we neglect the 
case where both background counts and true signal click since rj and Yqb are small. We 
remark that Eqs. (j3J) and (jSJ) are true for both triggered and non-triggered cases. 



B. On Alice's side 



In the triggering PDC QKD, Alice may use either a threshold detector or a photon- 
number resolving detector. Define an N-photon-resolving detector to be a detector that can 
tell 0, 1, • • ■ , N photons of incoming signal. For a threshold detector, we have N = 1, which 
can only tell there are photons presenting or not. Given an incoming i-photon state, the 
probability for Alice's detector to indicate a j-photon state is r)j\i, with YjjZo Vj\i = 1 f° r 
all i — 0, 1, • • • . In general, %u's are real numbers in [0,1]. We define a j-photon trigger for 
the case that Alice's detector indicates a j-photon state. 

For a triggered PDC photon source, as given in Eq. ([2]), the probability for Alice's detector 
to indicate a j-photon detection is 



P 



Aj 



8=0 

With the assumption that the PDC source always emits photon pairs, the probability (gain) 
for Alice getting a j-photon detection and Bob getting a detection is 

oo 

where the yield 3^ is given in Eq. The quantum bit error rate (QBER) conditioned on 
Alice's j-photon detection, similar to Eq. (|7|), is given by 



Efj,,jQfj,,j ~ Qi,j e i 

(8) 



i=0 
oo 



sr v v. 



where the error rate e% is given in Eq. (JSJ). 

One observation is that in the triggering PDC QKD setup, shown in FIG.[U the quantities 
Yi and are independent of Alice's measurement outcome j. This is based on the single- 
mode PDC source assumption described in Eq. ([T]) in Section [Til Therefore, in Section IIVI 
we can apply the decoy state idea. 



C. Threshold detector 



Here we will discuss a special case that Alice uses a threshold detector. That is, 

w = (i-y 0A )(i-W 
^(i-im)' 

(9) 

Vl\i = 1 - Vo\i 

= 0, Vj > 2, 

where Y a and ^ are the background count rate and the detector efficiency on Alice's side. 
The approximation is due to the fact that normally we have t\a 3> Yoa- That is, we neglect 
the background contributions on Alice's side. 

According to Eqs. (JTj) and (151) , without Eve's interference, the gains and QBER's of 
triggered (j = 1) and non-triggered (j = 0) detections are given by 

1 1 - Y 0B 



< ^ M '° 1 + r] A /2 1 + (rj A + i] - tiav)^ 
n 1 1 I -Y 0B , I -Y 0B 



E^iQ^i = ejQ^i + 



1 + r] Af u 1 + r]fi l + (r] A + ri- Vav)^ 
(e - e d )y 0j B 



(10) 



1 + w 

(e - e d )rjAnY 0B 



1 + W 

Without Eve's interference, the gains and error rates of the single photon state in two 
detections are given by 

eiYi = e d Yi + (e - e d )F s 
where Y\ and ei are given in Eq. (j4j) and (jSJ), respectively. 



D. Perfect photon-number resolving detector 



Here we will discuss the case that Alice uses a perfect photon-number resolving detector, 
which can faithfully tell the number of photons in the incoming signal. That is, rjju = 5ij. 
Thus the gains and QBER's are given by, from Eqs. and (JSJ), 

Qii,i = Qi,i = t n \i+i Yi 

a* (i2) 



from where one can directly infer the gains and error rates of z-photon state, Qij = Qi^S, 



IV. POST-PROCESSING 



In the following discussion, we will focus on BB84 protocol [jj. Due to PNS attacks 



14 



151 ]. only vacuum states and single photon states are secure for BB84 protocol, which 



may not be true for other protocols, such as SARG04 40]. 

Similar to the coherent state QKD, we can apply GLLP [12] security analysis to the 
triggering PDC QKD. First, Alice and Bob perform error correction, after which they will 
share an identical key. Then, they perform privacy amplification to different types of qubits 



separately. Since here we assume only vacuum states and sing 



BB84 protocol, the key generation rate is given by 



19 



41 



42 



e photon states are secure for 



R > q{-f{E^)Q^H 2 {E^) + Q 1 [l - H 2 ( ei )) + Q }, 



(13) 



where q is the basis reconciliation factor (1/2 for the BB84 protocol due to the fact that 
half of the time Alice and Bob disagree with the bases, and if one uses the efficient BB84 
protocol [43J], q ~ 1), the subscript /i denotes for the expected photon pair number, and 
are the overall gain and QBER, Q\ and e\ are the gain and error rate of single photon 
states, Qo is the gain of vacuum states, f(x) is the bi-direction error correction efficiency 
(see, for example, 4J|) as a function of the error rate (normally f(x) > 1 with the Shannon 
limit f(x) = 1) and H 2 (x) = —x log 2 (a;) — (1 — x) log 2 (l — x) is the binary entropy function. 

All the classical data measured can be grouped according to Alice's detection events, 
j = 0, 1, • • • , N. Then we can apply the GLLP idea [12j, |45[ to each group. The final key 
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generation rate will be given by summing over contributions from all groups, 



JV 



R - 2_^Rj. 

j=0 



(14) 



In each case j, one can apply Eq. (l23l) . 



Rj > g{-f(E^)Q^H 2 (E^) + Q ltj [l - H 2 {e x )\ + Q 0>j }, 



(15) 



where Qqj and Qij are the first and second terms in the right hand side of Eq. ([7]). Here 
the error rate of single photon state e\ is independent of j, see the observation in the end 
of Section IIIIBI We note that the key generation rate from all j-photon trigger detections 
should be non-negative. If any of them contributes a negative key generation rate, we should 
assign to it. In this case, Alice and Bob can just discard that type of detections. Based 
on this observation, we can further simplify Eq. (fl4"l) . Given Alice detects more than one 
photons, the probability of emitting single photon state in Bob's arm is small [5JJ. As we 
mentioned in the beginning of this section, only single photon state can contribute positively 
to the final key rate. Thus we can focus on the case j = 0, 1. 



where Ro and R\ are given in Eq. (fl~5]) . Again, both R Q and Ri should be non- negative, 
otherwise should be assigned 0. 

In Eq. ( |T5l) . the gain Q^j and the QBER E^j, given in Eqs. ([7]) and (IE]), can be measured 
or tested from QKD experiments directly. In this section, we will discuss various ways to 
estimate Qqj, Qij, and e\. We assume that the PDC photon source and detector character- 
istics are fixed and known to Alice. That is, /i, the photon number distribution in Eq. ([3]) 
and r]A are fixed and known. 

A. Non-decoy states with threshold detectors 

Here we assume that Alice uses a threshold detector. Thus, Alice only has two measure- 
ment outcomes, j = 0, 1. One simple way to estimate Qoj, Qi,j, and e\ is by assuming that 
all losses and errors come from the single photon states. This is because Eve can in princi- 
ple perform PNS attacks on the multi-photon states. The gain and error rate of the single 



R — Ro + Ri-, 



(16) 
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photon states in triggered (j = 1) and non-triggered (j = 0) detections can be bounded by 

oo ,• 

n 1 



Qi,o > Q»,o - (i + fi y+i^l 



;i + r/ A /i)(l + / u) 2 
n >n ^(2-^ + /i)/i 2 (17) 

ei ,o > 



ei,i > 



Qi,o 



Qi,i 

where 77^ is the efficiency of Alice's detector. The gain and the QBER E^, given in 
Eqs. ((7|) and (|8l) , can be measured or tested from QKD experiments directly. In the following 
simulations, we will use Eqs. f fTUj) . Since we assume all errors come from the single photon 
states, one should take the lower bound of the vacuum contribution to be Qoj = 0. 



B. Infinite active decoy state with threshold detectors 

To do privacy amplification, Alice and Bob need to bound Qo,j, Qi,j, an d e% for Eq. i fTBT) . 
From Eq. (JTj), we know that to bound Qoj and Qxj, Alice and Bob need to estimate Y\. 



Decoy state method provide a good way to estimate Y\ and e\ [16l . Il9| . The essential idea 
is that instead of considering each linear equation of Y\ and e\ in the form of Eqs. ([7j) and 
dHJ separately, Alice and Bob consider all the linear equations simultaneously. 

Let us imagine that Alice and Bob obtain an infinite number of linear equations in the 
form of Eqs. (JTj) and (jSJ), e.g., they use an infinite number of intensities \i. In principle, 
Alice and Bob can solve the equations to get Y\ and e\ accurately. Mathematically, the 
problem is solvable. The intuition is that the contributions from higher order terms of Y± 
and ej decrease exponentially in Eqs. (jTj) and dHJ). For the case coherent state QKD, one or 



two decoy states are proven to be sufficient 
sufficient for triggering PDC QKD. 



20| | . Shortly, we will see that one decoy state is 



We remark that the key underlying assumption of the decoy state method is 19 ] 

Yi(decoy) = Yi(signal) ^ 
ei(decoy) = ei(signal). 
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In another word, Eve sets the same values of Yi and for decoy and signal states. This can 
be guaranteed by the assumption that Eve cannot distinguish decoy and signal states. 

In Appendix |AJ we will show that the optimal /i for the infinite decoy state case is in the 
order of 1, \x = 0(1), which yields final key rate R = 0(rj). On the other hand, the optimal 
fi for non-decoy case is /i = 0(77), which yields final key rate R = 0(rf). Therefore, we 
expect the decoy state QKD to become a standard technique not only in the coherent state 
QKD, but also in QKD with triggering PDC sources. 



35 



here are various ways to apply the decoy state idea to the triggering PDC QKD [34, 



361 ] . Here we consider the upper bound (infinite decoy state case) of all possible decoy 
protocols of triggering PDC QKD with threshold detectors: triggering PDC+infinite decoy 
method [19|]. In the infinite decoy state method, Alice and Bob perform infinite number of 
decoy states by choosing different intensities of the PDC source, /i. Then they can solve the 
linear equations in the form of Eqs. ([7]) and ([8]) to estimate Y\ and e x accurately. So they 
can calculate each Qoj, Qij, and t\ accurately. In the simulation, we will use Eqs. ( fTUl) and 
ffTTT) directly. 

C. Weak active decoy state with threshold detectors 

Here we assume that Alice and Bob use threshold detectors and focus on triggered de- 
tection events. Alice uses another intensity u, say by attenuating pumping laser, for the 
weak decoy state. Wang, Wang and Guo have proposed a practical decoy method for trig- 



gering PDC QKD [36|, which is essentially applying vacuum+weak decoy state method [20] 
Note that for triggered detection events, the vacuum contribution can be negligible since 
t]a 3> Yqa- Thus there is no need to estimate the vacuum contribution here. So Alice and 
Bob only need to perform weak decoy state instead of vacuum+weak decoy states. In this 
case, only one weak decoy state is sufficient. 

Bounds of Y"i and e\ are given by /x 2 (l + u) 3 x Q vX — v 2 {\ + fi) 3 x in Eq. ([7]) and 
Eq. §]) 

Yi > / J -(i + v) 3 Q»\i - -(i + a0 3 Qm|i] 

. f (l + ^E^Q^ (1 + vfE^Q^ 1 > 

e x < mm{ -f , — } 

where v is the expected photon pair number of the weak decoy state and t]a is the efficiency 



13 



of Alice's threshold detector. 

It is not hard to show that when v — > 0, Eq. ffl9l) approaches the infinite case, Eqs. fflUj) 
and (TTTj) . described in the previous subsection. 

D. Passive decoy state 

Recently, Mauerer and Silberhorn proposed a passive decoy state scheme, in which 
photon-number resolving detectors are required [341 ] . Let us recap the heuristic idea of 
the original passive decoy state scheme briefly here. As discussed in the Section IIII[ Alice 
and Bob eventually get different detection events grouped by triggers on Alice's side. The 
key idea proposed by Mauerer and Silberhorn is that Alice and Bob manually combine the 
{j}-trigger detection events to get the decoy states with different photon number statistics 
and then follows regular decoy state scheme. 

Here we want to point out that the "combination" step is unnecessary. In general, each 
detection event group with j-trigger has a different photon number statistics on photon 
source arm. Thus, what Alice and Bob need to do is treating all {j}-trigger detection events 
statistics separately. Furthermore, photon-number resolving detectors are not necessary in 
passive decoys state scheme. Our new generalized passive decoy state scheme is as follows. 

1. Alice uses a PDC source as her triggered photon source. She detects one of the modes 
from her PDC source as trigger and encode key information into another mode. Due 
to the detector Alice uses, she will get different trigger events: j — 0, 1, • • • . When she 
uses a threshold detector, she will only get j = 0, 1. 

2. As usual BB84 protocol, Bob measures signals in two different bases. Alice and Bob 
perform basis reconciliation. 

3. Alice announces her trigger detection results for each pulse: j. Bob group his detection 
events by the information j. For each j, they calculate the gain Q^j and test the QBER 

Mathematically, they will obtain a set of linear equations in the form of Eqs. ([7]) and 
(JE1). Notice that the setup parameters, \x and rjj\i's, are known to Alice and Bob. Thus, 
they can estimate Y\ and t\ by considering Eqs. (171) and (JED- 
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4. Apply post-processing according to Eq. (Ti~6]) . 

We remark that the scheme is called passive because Alice does not actively select decoy 
states. Instead, she determines the decoy states by measuring the trigger mode. Later, we 
will show that this is one advantage of using triggering PDC source for QKD. Actually, in 
this case, there is no strict definitions of decoy states and signal states. In the original decoy 
state method |20|, decoy states are only used to estimate Y\ and t\ and the key is always 
generated non^na! state, fl In t ri ggering PDC QKD case, both the triggered j = 
and non-triggered j = 1 detection events may have positive contribution to the final key 
generation. 

E. Passive decoy state with threshold detectors 

Here we will review the decoy protocol proposed by Adachi, Yamamoto, Koashi and Imoto 



35j as a special case of the passive decoy state protocol. The AYKI protocol is interesting 
in practice since it doesn't involve any hardware change to implement decoy state. 

Both Alice and Bob use threshold detectors, thus they have two types of detection events, 
triggered (j = 1) and non-triggered (j = 0). Secure keys can be generated from both types 
of detection events. Following the passive decoy state method procedure described in the 
previous subsection, Alice and Bob can estimate Y\ and e\ by considering the statistics of 
triggered and non-triggered detection events together. This is conceptually similar to one 
decoy state idea j^ol ]. 

By solving two linear equations of Eq. ([7]) with j = 0, 1, [1 — (1 — ??a) 2 ] x Qfi,o — (1 — 
Va) 2 x Qti,i, one can get 

Yi > Y? es ^±^[^(Q M , - Qo,o) - l ~^Q,A (20) 

H l-rj A 7] A 

where Qo,o is the vacuum state contribution in non-triggered detection events. One need 
to minimize the key rate of Eq. (fT6l) for Q with the constraint of Eq. (jSj). We note that 



this result is essentially the Eq. (14) given in Ref. 35j. We can see that when 77^ is close 
to 1 or n is small, after neglecting Q^ (background counts), the lower bound is tight 
(approaches the real value of Yi, see Eq. (j3J), 

lim Y? = lim Yf = rj. (21) 
15 



By neglecting the vacuum state contribution for triggered detection events, Qo,i = 0, e\ 
can be simply estimated by 

gi < (22) 
Vi, l 



To get the lower bound of Y\ in Eq. (1201) . one has to estimate the background contribution 
Qo,o as well. One simple bound of Qo,o is < Qo.oeo < E^qQ^q from Eq. (jSJ), where eo = 1/2. 

We note that the key rate calculated by substituting Eqs. fl20|) and fl22l) into Eq. ffTBT) is 
not optimal. To get a tighter key rate bound, one can numerically lower bound Eq. (|T6|) 
directly given the measurement results, Eq. ffTTT) . 

F. With a perfect photon-number resolving detector 

Here we discuss a special case that Alice uses a perfect photon-number resolving detector, 
discussed in Section IIII Dl Now that Alice knows the exact photon number of the source, 
Alice and Bob only need to focus the post-processing on the single photon state detection 
events. In this case, the BB84 protocol is implemented by single photon states only. Thus, 
they can directly apply Shor and Preskill's formula 5), 33| 

R > - /(ei)# 2 (ei) - H 2 {e x )\. (23) 

Later from the simulation, shown in Fig. [2], we can see that a perfect photon- number resolving 
detector does not improve the QKD performance dramatically comparing to the threshold 
detector case. 



G. A few remarks 



From the analysis of optimal /1 in Appendix |Al one can see that the key rate for the case 
without decoy states quadratically depends on the channel loss, R = 0(i] 2 ), while for the 
case with decoy states, R = 0(rj). This result is consistent with prior work in comparing 
the cases of coherent state QKD with and without decoy states 19]. 



In the decoy state security proof 



19], the key assumption is that the decoy state and 



signal state should satisfy Eq. (fISl) . This is guaranteed by the assumption that Eve cannot 
distinguish decoy and signal states. However, in the active decoy state method, Alice may 
introduce side information that can distinguish decoy and signal states when she actively 
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prepares decoy and signal states. For example, an attenuator on Alice's side, used to prepare 
different intensities for signal and decoy states, may introduce different frequency shifts for 



signal and decoy states [24J . In general, it is hard to verify the assumption that Eve cannot 
distinguish decoy and signal states in real active decoy state experiments. 

In the passive decoy state scheme, decoy and signal states are passively determined by 
Alice's measurement outcome. Alice does not use an extra component (like in active decoy 
state method) to prepare decoy states. This reduces the possibility of side information 



leakage. By passively choosing decoy states, Alice prepares same states on Bob's arm [53 ]. 
In fact, Alice can measure trigger signals after Bob finishes his measurements. Thus, to 
Eve's point of view, the states transmitted through the channel is independent of Alice's 
measurement results (J). Therefore, in principle, Eve cannot distinguish the decoy and 
signal states in the passive decoy state QKD. 

This is the main advantage to use passive decoy state methods. Note that for coherent 
state QKD, one can only use active decoy state idea. 

V. SIMULATION 

In this section, we will compare the passive decoy state with a perfect number resolving 
detector and four QKD implementations with threshold detectors: non-decoy, infinite decoy, 
weak active decoy and AYKI (passive decoy state). 



We deduce experimental parameters from a recent PDC experiment [38], which are listed 
in TABLED In the following simulations, we will use q = 1/2 and f{E^) = 1.22 in Eq. fTT5l) . 
We notice that with the slightly modified experiment setup, a coherent state QKD with 



decoy states has been implemented [38j|. Thus, it is reasonable to use this experiment setup 
to simulate the five QKD implementations. 

In the simulation, for fair comparison, we always assume Bob uses the same detection 
setup (with threshold detectors). 

A. Without statistical fluctuations 

In the first simulation, we consider the case that Alice and Bob performs an infinitely 
long QKD (no statistical fluctuations). In this case the weak active decoy state protocol 
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Frequency 


Wavelength 


Va 


VBob 




Yob 


249MHz 


710 nm 


14.5% 


14.5% 


1.5% 


6.024 x 10~ 6 



38|. Here t\a and ry^of, are the detection 



TABLE I: List of parameters from 144 km PDC experiment 
efficiencies in Alice and Bob's detection system, not including the optical channel loss, is the 
intrinsic detector error rate. Yqb is the background count rate of Bob's detection system (for 
example, if Bob has two detectors, then Yqb will be the sum of two detectors' background count 
rates). The transmission efficiency r/ in Eq. (T4|) is given by r]Bob plus the channel loss. 

will approach the infinite decoy case {2^. We assume that Alice is able to adjust /x (the 
brightness of the PDC source) in the regime of [0, 1] arbitrarily. In the simulation, we 
numerically optimize \x for each of the four implementation protocols: non-decoy, infinite 
decoy, AYKI and the case with a perfect number resolving detector. The simulation result 
is shown in FIG. [2j 



10" 




FIG. 2: Plot of the key generation rate in terms of the optical loss, comparing four schemes without 
considering statistical fluctuations: non-decoy, infinite decoy, AYKI and the case with a perfect 
number resolving detector. Here we use q = 1/2 and f{En) = 1.22. We numerically optimize fx for 
each curve, see Appendix [A] for more discussions. Simulation parameters are listed in Tabled 
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From FIG. [2, we have the following remarks. 

1 . In Appendix [AJ instead of numerically optimizing /x as done for Fig. ([2]) , we quali- 
tatively investigate the optimal /i for triggering PDC QKD with and without decoy 
states. The simulation result is consistent with the qualitative conclusion R = 0(rj) 
for the case with decoy state and R = 0{rf) for the case without decoy state. 

2. The space between the solid line and dashed line in FIG. |2] indicates the room left for 
improvement by other decoy protocols with threshold detectors after AYKI protocol is 
implemented. We can see that, in a large optical link loss regime, the performances of 
AYKI and the infinite decoy are close. For instance, the AYKI protocol yields around 
50% of the key rate of the infinite decoy state protocol when the channel loss is within 
20dB. 

3. By comparing AYKI and the case with a perfect photon- number resolving detector, 
we can see that even with a perfect photon-number resolving detector on Alice's side, 
the key rate is not improved dramatically in a large optical loss regime. 

4. The non-decoy protocol is better than AYKI in the regime close to maximal secure 
distances. This is because we use the bounds of Eqs. (J2"D]) and (J2"2"j) for AYKI curve. 
In reality, Alice and Bob can use the bound of Eq. (fTTj) directly in this regime. 

5. There is a bump in each curve. This is due to the fact that in the key generation rate 
formula Eq. (1161) . the non-triggered detection events have no contribution to the final 
secure key after the bump. 

6. At the point of loss=0 dB, the key rates of four cases (from top to bottom) are 
1.21 x 1(T 2 , 8.6 x 10~ 3 , 4.2 x 1(T 3 and 1.3 x 1(T 3 . 

7. At the point of loss=0 dB, the numerical results for optimal /i for four cases (from 
top to bottom) are: 1, 0.52, 0.194, 0.0589. The optimal \x for the case with a perfect 
threshold detector is always 1, which is reasonable since \x = 1 maximizes the single 
photon state probability. In Appendix |A], we show that the optimal /x's for the infinite 
decoy and AYKI case are relatively stable in a large optical loss regime. The optimal 
\i for the no decoy state case decreases with channel loss. 
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8. We remark that the real fi used in the experiment 38| is fi — 0.0265. In general, it is 



experimentally hard to increase the brightness (ft) of a PDC source. 
9. All of the four cases can tolerate similar optical losses. 

B. With statistical fluctuations 

In a real experiment, the key length is always finite. Alice and Bob should consider sta- 



tistical fluctuations. As pointed in Ref. [20|, statistical fluctuation analysis is a complicated 
problem in decoy state QKD. 



Similar to the analysis in Ref. 20[], we assume a few conditions: 



1. Alice knows the exact value of average photon pair number fi, which is a fixed number 
during key transmission. 

2. The distribution of photon number, Eq. ([3]), does not fluctuate. 

3. Assume the QKD transmission is part of an infinite length experiment. 

Here we focus on the three cases with threshold detectors: infinite decoy, weak decoy 
and AYKI. We assume that the data size is 6 x 10 9 pulses of Alice's pumping laser. The 
simulation result is shown in FIG. O From the simulation result, we have the following 
observations. 

1. Similar to the case without fluctuation analysis, in a large optical link loss regime, the 
performances of AYKI and the infinite decoy are close. 

2. At the point of loss=0 dB, the key rates of the three cases from top to bottom are 
8.6 x 10~ 3 (infinite), 5.0 x 10" 3 (weak) and 4.7 x 10~ 3 (AYKI). 

3. The maximal tolerable secure optical losses for three cases are rather similar: 37dB 
(infinite), 32.5dB (AYKI), 32dB (weak). 

4. The AYKI protocol yields a higher key rate than weak decoy state protocol when the 
loss is greater than 16 dB. AYKI is less affected by statistical fluctuations than the 
weak decoy state because in AYKI, Alice does not need to sacrifice extra pulses for 
decoy states. 
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Optical link loss [dB] 

FIG. 3: Plot of the key generation rate in terms of the optical loss, comparing three cases with 
threshold detectors after considering statistical fluctuations: infinite decoy, weak active decoy and 
AYKI. We numerically optimize /x for each curve. Here we use q = 1/2 and /(E^) = 1.22. In 
the weak decoy state case, we assume Alice can randomly attenuate her PDC source intensity. 
Simulation parameters are listed in Table [H The data size is 6 x 10 9 pumping laser pulses on 
Alice's side. 

In Section IIV G\ we pointed out that from a practical security point of view, the passive 
decoy state method has an advantage over active decoy state methods. Also, AYKI method 
does not require any additional hardware change to implement decoy state, while in the 
weak decoy state case, Alice needs to add an attenuator to create decoy states. Now, from 
the simulation result, we can see that AYKI and weak active decoy state method yields 
similar QKD performance. Thus, our conclusion is that one should just use AYKI method 
instead of the weak decoy state method. 



10" 9 
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VI. CONCLUSION 



By investigating the optimal photon source intensity, we find that the triggering PDC 
QKD setup with decoy states is able to achieve a key rate that linearly depends on the 
channel transmittance, comparing to the quadratic dependence for the case without decoy 
states. Therefore, we expect the decoy state QKD to become a standard technique not only 
in the coherent state QKD, but also in QKD with triggering PDC sources. 

On the practical side, we generalize the passive decoy state idea. The generalized passive 
decoy state idea can be applied to cases where either threshold detectors or photon number 
resolving detectors are used. The decoy protocol proposed by Adachi, Yamamoto, Koashi 
and Imoto (AYKI) can be treated as a special case of the generalized passive decoy state 
method. Comparing to the active (regular) decoy state methods, the passive one opens 
less possibility for Eve to distinguish decoy and signal states, which is a key underlying 
assumption in the security proof of decoy state QKD. From this sense, the passive decoy 
state method is more secure than the active decoy state methods in practice. 

By simulating a recent PDC experiment, we compare various practical decoy state pro- 
tocols with the infinite decoy protocol. We also compare the cases using threshold detectors 
and photon-number resolving detectors. Our simulation result shows that with the AYKI 
protocol, one can achieve a key generation rate that is close to the theoretical limit of in- 
finite decoy protocol. Furthermore, our simulation result suggests that a photon-number 
resolving detector has little room to improve the QKD performance, comparing to the case 
using threshold detectors. 

We also consider the statistical fluctuations. We compare infinite decoy protocol, weak 
active decoy state method and AYKI protocol. The simulation result shows that the weak 
active decoy state method and AYKI protocol yield very close QKD performance. In a large 
optical loss regime, the AYKI protocol can achieve a performance that is close to the infinite 
decoy case. Since the AYKI protocol requires no hardware changes for triggering PDC QKD, 
we conclude that AYKI method is a good protocol for triggering PDC QKD experiments. 

Although our analysis is focused on the QKD with PDC sources, we emphasize that it 
can also be applied to other QKD setups with triggered single photon sources. 
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APPENDIX A: OPTIMAL fj, 

The optimal \x for the coherent state QKD with and without decoy states has already been 
studied [20|. Here instead of numerically optimizing \i as done for Fig. (J2J), we qualitatively 
investigate the optimal /x for the triggering PDC QKD with and without decoy states. Here 
we are interested in the case that Alice uses a threshold detector. 



1. Without decoy states 

Let us begin with the optimal /i of the case without decoy states. Here we will apply 



GLLP 12j security analysis. As shown in Ref. 46(, GLLP and Lutkenhaus's |8( security 
analyses achieve similar performances for the coherent state QKD. Intuitively, we should get 
a similar optimal /x as given in Ref. jg|, /x ~ r//2. 

From Eq. (flOl) . we can see that the gain Q^j (j = 0, 1) is in the order of fit]. To keep 
Qi,o or Qi,i i n Eq. (IT7|) positive, /1 should be in the order of 77. By assuming /x, 77 and Y 0B 
are small, we can simplify Eq. (TTU]) 

E^o ~ E^ w e d 

(Al) 



1 



e ~ 



v-t* 

where Qf + Q\ x is the lower bound of Qi,o + Q\,\ an d e i is the upper bound of e\ from 
Eq. (1171) . Since the error rates from triggered (j = 1) and non-triggered (j = 0) detection 
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events are the same, the key generation rate given by Eq. (|23|) can be simplified to 



R > qi-fiEjQpHziEj + Q 1 [l - H 2 ( ei )] + Q } 



~ q{-f(e d ) W H 2 (e d ) + ( W - ^)[1 - H 2 ( 
By taking derivative of R, the optimal {i = xr\ satisfies 



ye d 



)]} 



- f(e d )H 2 (e d ) + l-2x + e d log 2 + (1 - e d - 2x) log 2 (l - = 0. 



1 — x ' • I — x 

Here if set e d = 0, then we get x = 1/2 which is compatible with Lukenthaus' result 
note that x = 1/2 essentially maximize the probability of single photon source Qf 
in Eq. (lAlj) . More precisely, we can solve Eq. (IA3I) numerically, see FIG. SJ 

0.5 



(A2) 



(A3) 
i. We 
+ Qtx 
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Intrinsic detector error rate e_, 



FIG. 4: Plot of the optimal [i in terms of e d for triggering PDC+non-decoy. Here we use f(e d ) 



1.22 since the error rate is less 10% 
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From FIG. HJ we can see that the optimal /i for triggering PDC+non-decoy is fi = 0(r]), 
which will lead the final key generation rate R = 0(rj 2 ). 



2. With decoy states 



With decoy states, Alice and Bob can estimate Q\ and e\ better. Here we consider the 
infinite decoy state case with threshold detectors. Under the assumption that r\ and Y 0B are 
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small, we can simplify Eqs. ( TTUj) and (11 ip . 



/x,0 



Qi,o + Qi, 



(A4) 



ei ps e d 



With these approximations, the key generation rate given in Eq. (|23|) can be simplified 



to 



R ~ q{-f(e d )r]fiH 2 (e d ) + 
The optimal /i satisfies 



77/x 



a+/^) 2 

1 — A* f(e d )H 2 (e d 



[1-H 2 (e d )}}. 



(AS) 



(A6) 



(l + /i) 3 l-if 2 (e d ) 

Here if set e d = 0, then we get /i = 1 with which the probability to get a single photon state 
is maximized. The numerical result of Eq. (1A6I) is shown in FIG. 
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Intrinsic detector error rate e_, 



FIG. 5: Plot of the optimal fx in terms of e d for the triggering PDC+infinite decoy. Here we 
use/( ed ) = 1.22. 



From FIG. [51 similar to the case coherent state QKD with decoy states 20], one can see 
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that the optimal fi is independent of channel loss r\ for the infinite decoy state case with 
threshold detectors, i.e., fi = 0(1), which will lead the final key generation rate R = 0{rj). 



3. Numerical checking 



Now we would like to numerically compare the optimal /i with and without decoy states 



by simulating a recent PDC experiment 
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with parameters listed in Table [H In the 



simulation, we numerically optimize \i for the key rate given by Eq. ( Tl6l) for the non-decoy 
and infinite decoy methods. For this particular setup, the optimal /i is shown in Figure O 



Optimal p. for infinite decoy 

- - Optimal \i/r\ for non-decoy 




15 20 25 30 35 
Optical link loss [dB] 
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FIG. 6: Plot of the optimal fx in terms of optical loss for triggering PDC+non-decoy and triggering 
PDC+infinite-decoy. Here we use q = 1/2 and /(E^) = 1.22. Simulation parameters are listed in 
Table E 



From the figure we can see that the optimal \x for the non-decoy case is in the order of rj, 
while the optimal /i for the infinite-decoy case is in the order of 1. This is consistent with 
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the results of the analysis in the two previous subsections. 
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